Appendix D Security Questionnaire.xlsm
XLSM spreadsheet 43 KB Posted
- Attached to
- DOIT - Managed Application Services
- Solicitation number
- RFP27006832
- Issued by
- Providence County, Rhode Island
About this file
Security Questionnaire Summary
This is a Security Questionnaire document required by the Rhode Island Division of Enterprise Technology Strategy and Services (ETSS) within the Department of Administration for vendors responding to the Application Managed Services RFP27006832. The questionnaire is a Microsoft Excel file (.xlsm) containing approximately 50 security-related assessment questions across multiple domains including access controls, audit logging, incident response, patch management, and disaster recovery. Vendors must complete the questionnaire by providing responses in the designated columns, with answers formatted as either Yes/No dropdown selections or free-text entries. The questionnaire was last updated on August 22, 2025, and vendors are instructed to enable macros upon opening the spreadsheet to properly utilize the dropdown functionality.
The questionnaire implements a tiered completion structure wherein vendors demonstrating active FedRamp authorization or current-year ISO 27001/27002 or SOC 2 Type 2 attestation need only identify their certification type in Question 6, thereby completing the questionnaire early. Vendors lacking these certifications must complete all remaining questions addressing topics such as information security policies, user authentication and authorization processes, security awareness training, configuration management, cryptographic controls, vendor management requirements, network security measures, compliance standards, data breach history, disaster recovery procedures, employee background checks, and server hardening policies. The questionnaire serves as a risk assessment tool to evaluate vendor security posture and determine organizational capability to meet the state's information security requirements for managed application services delivery.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFP27006832_Aug_10_26_solicitation_doc.pdf | ||
| Addendum B RI General Conditions of Purchase - IT Policies - Revised.docx | DOCX document | |
| RFP27006832 Solicitation Specifications.pdf | ||
| RFQ27006835 Generator SOW.pdf | ||
| RFP27006832_Jul_20_26_solicitation_doc.pdf | ||
| Addendum E Business Associate Agreement.docx | DOCX document | |
| Appendix F Vendor Checklist to RI GCOP Addendum B IT Policies - Revised.xlsx | XLSX spreadsheet | |
| RFP27006832 Questions and Answers.xlsx | XLSX spreadsheet | |
| Exhibit 1 AMS Minimum Service Level Agreement.docx | DOCX document | |
| Appendix F Vendor Checklist to RI GCOP Addendum B IT Policies.xlsx | XLSX spreadsheet | |
| ISBE Form - RFP Appendix B - 12.01.2025.pdf | ||
| Appendix E RI ETSS Application Inventory.docx | DOCX document | |
| RFP27006832_Jul_15_26_solicitation_doc.pdf | ||
| Supplemental Bidder Attestation - 12-01-2025 (1).pdf | ||
| Addendum B RI General Conditions of Purchase - IT Policies.docx | DOCX document | |
| Appendix C AMS RFP Cost Proposal.xlsx | XLSX spreadsheet |
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Engagement Risk Assessment Data
| Engagements | CI001 | CI002 | CI003 | GSPG001 | GSPG002 | GSPG003 | GSPG004 | GSPG005 | GSPG005A | GSPG006 | GSPG006A | GSPG006B | AC001 | AC002 | AC003 | AT001 | AT002 | AT003 | AU001 | AU002 | CM001 | CM002 | CM003 | CM004 | IA001 | IA002 | IR001 | IR002 | MA001 | MA002 | MP001 | PE001 | PE002 | RA001 | RA002-1 | RA002-2 | RA003 | RA003-2 | SA001 | SA002 | SA003 | SC001 | SC002 | SI001 | SI002 | CL001 | CL002-1 | CL002-2 | DR001 |
| No |
Instructions How to Complete the Security Questionnaire (last update date: 8/22/25)
As the Vendor completing this Questionnaire, the Security Questionnaire tab is where work will be completed. The file contains 3 columns, in column A you will see the question, Column B is where the answer will be provided, and in Column C is the answer format accepted in Column B.
The two types of formatting accepted for answers are Yes/No drop downs and free text values.
For the cases in which you need to select Yes or No, there's a dropdown. Click the arrow on the appropriate cell in Column B to display your drop down options.
1. Enable Macros when you first open the spreadsheet.
2. Per design when you complete question 5, if you select "Yes" to whether you have an active FedRamp authorization or current year ISO27001/27002 or SOC 2 Type 2 attestation, you only need to specify which type of certification you have (e.g. FedRamp, ISO27001/27002, SOC 2 Type 2) in question 6 which will complete the questionnaire for your organization. If you answer "No" to question 5, you must complete all the remaining questions in the questionnaire.
Security Questionnaire
| Question | Answer | Options/Type of response |
| Legal Name of the Company | Text | |
| Address and Location of Operations | Text | |
| Contact Information of the Security Team | Text | |
| Do you have an active FedRamp authorization or current year ISO27001/27002, or SOC 2 Type 2 attestation? | No | Values List (Yes, No) |
| Please select one from the list | Values List | |
| Do you have a written information security policy? | Values List (Yes, No) | |
| How often is your security policy reviewed and updated? | Text | |
| Describe the roles and responsibilities of your information security team | Text | |
| Do you have a Security System Plan (SSP)? | Values List (Yes, No) | |
| Do you have a current year SAS70, SSAE16 or PCI attestation? | Values List (Yes, No) | |
| If not within current year, do you have a bridge letter to accompany the reports for the current year? | Values List (Yes, No) | |
| Please Provide details if needed. | Text | |
| How do you manage access to systems and data, including remote access? | Text | |
| Describe your user authentication and authorization processes. Please note if you require use of multifactor authentication (MFA). | Text | |
| How do you ensure least privilege principles and separation of duties are followed in your organization? | Text | |
| What type of security awareness training do you provide to your employees? | Text | |
| How frequently is this training updated and provided? | Text | |
| Do you provide role-specific cyber security training? | Values List (Yes, No) | |
| Describe your audit logging processes. Include a high-level summary of what events are logged, and how long are logs retained? | Text | |
| How do you ensure the integrity of your logging and monitoring systems? | Text | |
| Describe your process for managing changes to system configurations. | Text | |
| Do changes require an approval by a change board or designee? | Values List (Yes, No) | |
| How do you ensure compliance with your configuration baselines? | Text | |
| Are changes tested and reviewed? | Values List (Yes, No) | |
| Do you provide unique identifiers for all users in your environment? | Values List (Yes, No) | |
| How do you manage cryptographic controls for securing authentication processes? | Text | |
| Describe your incident response plan. How are incidents identified, assessed, and remediated? | Text | |
| What is your process for reporting security incidents? How do your 3rd parties report to you? | Text | |
| What are your procedures for system maintenance? | Text | |
| How do you ensure that maintenance activities do not compromise security? | Text | |
| How do you manage and protect your digital and physical media containing sensitive information? Describe your data destruction and disposal processes. | Text | |
| What physical security measures are in place at your facilities? | Text | |
| How do you protect your systems from environmental risks? | Text | |
| Describe your risk assessment methodology and framework. How frequently are risk assessments conducted? | Text | |
| Do you maintain a risk register? | Values List (Yes, No) | |
| How do you incorporate findings from risk assessments into your security strategy? | Text | |
| Is penetration testing performed? | Values List (Yes, No) | |
| If yes (penetration testing is performed), how frequently and by whom? | Text | |
| How do you evaluate the security of software and services before an acquisition? | Text | |
| Describe the security requirements you impose on your vendors. | Text | |
| How do you enforce these requirements to the sub-processers or 3rd parties of these vendors? | Text | |
| What measures do you take to protect your network and data transmissions? | Text | |
| Describe your approach to network segregation, firewall management, and intrusion detection systems. | Text | |
| Describe your processes for patch management and vulnerability scanning. | Text | |
| Describe your virus prevention, detection, and update processes. | Text | |
| Which industry-specific security standards or regulations are you compliant with, if any? | Text | |
| Have you ever been subject to a data breach or security incident? | Values List (Yes, No) | |
| If so, provide details on how it was addressed. | Text | |
| Summarize your disaster recovery plan, including overview of backup procedures and scenarios for primary/secondary hosting facility disasters. | Text | |
| Does your data center have an HVAC system, fire extinguishing system, and a generator? | Text | |
| Describe the physical and electronic security measures for your data center and applications. | Text | |
| Are employees subject to thorough background checks? | Values List (Yes, No) | |
| Who configures and deploys servers? Are the procedures documented? | Text | |
| Describe the policies and procedures for hardening servers. | Text | |
| What are your customer confidentiality policies and how are they enforced? | Text | |
| What are your procedures for handling and destroying sensitive data? | Text | |
| What is your data governance policy? | Text | |
| Please provide any additional information or comments that you think are relevant to your information security posture. | Text |
Sheet2
| Yes | FedRamp authorization |
| No | current year ISO27001/27002 |
| SOC 2 Tye 2 attestation |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .